โปรเจกต์ Web3
โชว์ผลงานและค้นหาโปรเจกต์น่าสนใจ
Web3Dev.th — เว็บโอเพ่นซอร์ส
หน้าเว็บโอเพ่นซอร์ส (MIT) ของ Web3Dev.th — รวมงาน บั๊กบาวน์ตี้ แกรนต์ แฮกกาธอน เควส คอร์ส และอีเวนต์สาย Web3 พร้อมค้นหาและกรอง โค้ดเปิดให้ศึกษา/fork ได้
ค้นหาบั้กความปลอดภัย
Coinbase's Bug Bounty Program exists to protect our two highest-priority assets: **customer funds** and **customer information**. We reward researchers who responsibly disclose software vulnerabilities that could put either at risk. To be eligible for an award, a report must present a clear list of steps that when executed demonstrate the impact of a vulnerability that harms Coinbase or its customers. Coinbase determines eligibility and reward amounts at its sole discretion. ## Scope The scope of this program is Web2 products, assets and infrastructure owned by Coinbase. Please see the Scope page for more details. If you have a Web3 finding pertaining to Coinbase, please submit through our program on [Cantina](https://cantina.xyz/bounties/55316f42-3c5e-4746-9bd0-0f18dcbc344b). ## Out of scope * Social engineering * Username enumeration * Rate Limiting (non-critical issues) * Physical security * Non-security-impacting UX issues * Deprecated open source libraries * Vulnerabilities in third-party applications that integrate with Coinbase * Ability to abuse existing banking functionality such as ACH or credit card chargebacks * Publicly available leaked credentials that have since been rotated * Demo apps, testnet, staging environments, etc. ## Severity & Rewards | Severity | What it looks like | Reward | | :---- | :---- | :---- | | **Extreme** | Unauthorized access to Coinbase-owned hot/cold wallet assets, funds, or private keys. | Up to **$1,000,000** | | **Critical** | Market-moving API/service abuse RCE on staking infrastructure Easily-exploitable, high-severity bugs in protocols accessible from the public API (e.g., signing, DKG, TDH2 in the cb-mpc open-source library) that could lead to key compromise or RCE. Exploitation requires no material precondition beyond normal protocol operation, and broadly affects typical deployments. Large-scale money laundering MNPI exposure, sustained business disruption, or significant monetary loss | Up to **$15,000** | | **High** | PII exposure affecting a meaningful share of users Fee-structure bypass at scale KYC bypass Single-product 2FA bypass High-severity bugs in protocols accessible from the public API (e.g., signing, DKG, TDH2 in the cb-mpc open-source library) that could lead to key compromise or RCE, but require additional—yet realistic—conditions, access, or effort to exploit. Exploitation must remain feasible in a realistic deployment and must not depend on unlikely conditions. | Up to **$6,000** | | Low / Medium | Out of Scope. | $0 | Severity is scored on **impact** (confidentiality, integrity, availability, fund and/or data exposure) and **exploitability** (access required, prerequisites, likelihood). **Note for the cb-mpc open-source library**: the extreme category is out of scope, and hard to exploit bugs are considered medium, and therefore also out of scope. # Program Policies ## Safe Harbor * Coinbase adheres to and supports the HackerOne Gold Standard Safe Harbor terms. ## Eligibility * Not be a resident of any country under U.S. sanctions or any country that does not allow participation * Be at least 14 years old with legal capacity to agree to these terms * Have permission from your employer to participate * Not be (for the previous 12 months) a Coinbase employee, immediate family member, contractor, or service provider ## Researcher Requirements * Submit all valid, Coinbase-related bug reports through our programs on HackerOne (for Web2), and Cantina (for Web3). * Provide Coinbase a reasonable amount of time to fix a vulnerability prior to sharing details with any other party. * Adhere to HackerOne Disclosure Process. * Make a good faith effort to preserve the confidentiality and integrity of Coinbase customer data. * Do not defraud or attempt to defraud or socially engineer Coinbase customers or Coinbase itself. * Do not profit from vulnerabilities outside of Bug Bounty Program payouts. * Report vulnerabilities with no conditions, demands, or ransom threats. Violation of any of our policy may result in the immediate ban from further participation in the Coinbase Bug Bounty Program. Researchers who engage in extortion attempts will be reported to law enforcement. ## Fine print Coinbase may modify or cancel this program at any time. Anonymous HackerOne reports are accepted but not reward-eligible. This is v5.0 of the program; see also [HackerOne's Finder Terms and Conditions]
สำหรับนักพัฒนา
🟣 Gibwork — find crypto gigs, get paid the moment you finish A bounty board on Solana. Answer questions, write code, or knock out small tasks and earn in USDC. 💸 Perfect if you're into Web3 and want a side income. Start free 👉 dub.sh/gibwork (On IG, tap the link in bio) #Gibwork #Solana #Crypto #Web3 #SideHustle #EarnCrypto #Bounties